<\/span><\/p>\nResearchers at Tel Aviv-based firm Checkmarx have discovered some serious flaws on Tinder \u2013 and we\u2019re not talking chipped teeth and lazy eyes. No, thanks to its lack of HTTPS encryption in some places and predictable HTTPS responses at others, Tinder may inadvertently be leaking information. Before this discovery, many had raised concerns regarding this, but for the first time, someone has laid it out in the open. Heck, they even uploaded videos on YouTube. If you\u2019re a Tinder user (like me), this should concern you. Let me try to clarify the doubts and questions you must (and should) have on your mind.<\/p>\n
What\u2019s at stake?<\/h2>\n
For starters, those fancy profile pictures you’ve uploaded to your Android\/iOS application can be seen by attackers. That\u2019s because profile pictures are downloaded via unencrypted HTTP connections. So, it\u2019s actually quite easy for a third party to see any pictures you\u2019re viewing. And on top of that, a third party can also see what action you take when presented with those pictures. These “actions” include your left-swipes, right-swipes, and matches.<\/p>\n
Here\u2019s how your data can be snooped<\/h2>\n
Unfortunately, Tinder is not as secure as we \u2013 Tinder users \u2013 wish it to be. That is down to two things: 1) Lack of HTTPS encryption and 2) Predictable response where HTTPS encryption is used.<\/p>\n
Basically this is a very teachable lesson in how not to employ SSL. Does Tinder have SSL. Yes. Technically. Is Tinder using encryption correctly? No. Absolutely not. In one place it hasn’t deployed encryption on a critical access point. In the other, it’s actively undermining its encryption by making its responses entirely predictable.<\/p>\n
Let\u2019s understand both of these scenarios.<\/p>\n
No HTTPS, Seriously Tinder?<\/h2>\n
Let me put this in simple words. Basically, there are two protocols via which information can be transferred \u2013 HTTP and HTTPS. The \u2018S\u2019 standing for secure makes all the difference. When a connection is made via HTTPS, the data in-transit gets encrypted. In this case, that data would be your photos. That’s how it should be. Unfortunately, the Tinder app doesn\u2019t allow users to send requests for photos to its image server via HTTPS. They\u2019re made on port 80 (HTTP). That\u2019s why if a user stays online long enough, his\/her photos could be identified. Additionally, that\u2019s what lets someone see what profiles and pictures you\u2019re viewing or have viewed recently.<\/p>\n
Predictable HTTPS Response<\/h2>\n
The second vulnerability comes as a result of Tinder accidentally undermining its own encryption. When you see someone’s profile pictures, what do you do? You swipe, right? (That comma makes a world of difference.) You might swipe left, right or swipe up. Communication of these swipes \u2013 from a user\u2019s phone to the API server \u2013 are secured via HTTPS. However, there\u2019s a catch, a massive one.<\/p>\n
The responses of the API server might be encrypted, but they\u2019re predictable. If you swipe right, it responds with 278 bytes. Similarly, a 374-byte response is sent for a right swipe, and a 581-byte response is sent in the case of a match. In layman’s terms, this is a lot like knocking a box to see if it\u2019s hollow.<\/p>\n
Thus, a hacker can see your actions just by just intercepting your traffic, without having to decrypt it. If I were a hacker, I\u2019d have a big fat grin on my face. The fix to this is easy, Tinder just needs to pad the responses so they\u2019re all one uniform size. Make them all 600-byte, something standard. Encryption doesn\u2019t do a whole lot when you can guess what\u2019s being sent simply by the size of the response.<\/p>\n<\/span>\nConcluding Thought<\/h2>\n
Is privacy just a fallacy in today\u2019s world?<\/em><\/p>\n","protected":false},"excerpt":{"rendered":"Tinder has HTTPS problems From a freshman emailing every Claudia on campus to a big security loophole \u2013 Tinder has generated plenty of headlines over the past 24 hours. And…<\/p>\n","protected":false},"author":10,"featured_media":5763,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":"","tve_updated_post":"","tve_custom_css":"","tve_user_custom_css":"","tve_globals":{},"tcb2_ready":0,"tcb_editor_enabled":0,"tve_landing_page":"","_tve_header":"","_tve_footer":""},"categories":[130],"tags":[170],"class_list":["post-5762","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-everything-encryption","tag-https","post-with-tags"],"views":11682,"jetpack_featured_media_url":"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2018\/01\/iStock-465496581.jpg","_links":{"self":[{"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/posts\/5762","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/users\/10"}],"replies":[{"embeddable":true,"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/comments?post=5762"}],"version-history":[{"count":0,"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/posts\/5762\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/media\/5763"}],"wp:attachment":[{"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/media?parent=5762"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/categories?post=5762"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/tags?post=5762"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}